CVE-2026-84533

Cryptographic Integrity Flaw Enabling Network Traffic Modification on Apple Platforms

Published Sep 14, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

A cryptographic issue was addressed with improved integrity checks. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27. An attacker in a privileged network position may be able to modify network traffic.

Analysis

Technical impact

A cryptographic flaw was identified in the integrity checks of Apple’s operating systems. The vulnerability allows an attacker with a privileged network position to modify intercepted traffic, potentially inserting or altering data before it reaches the target device. This weakness undermines the confidentiality and integrity of communications on the affected systems.

Affected Systems

Apple’s iOS, iPadOS, macOS, tvOS, and watchOS are impacted. The bug is resolved in the 27th revision of each platform: iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, and watchOS 27.

Risk and Exploitability

The CVSS score is 5.3. The EPSS score indicates a very low but non-zero exploitation probability (<1%). The vulnerability is not listed in CISA’s KEV catalog. An attacker must have a foothold in a privileged network segment to exploit the flaw, suggesting a limited but present attack surface. The potential impact remains the ability to tamper with network traffic destined for or originating from Apple devices, leading to data injection or compromise of secure communications.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 27

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 27

Apple

tvOS

affected

Version	Status	Constraints
`0`	affected	< 27

Apple

watchOS

affected

Version	Status	Constraints
`0`	affected	< 27

Configuration 1 [-]

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:tvos::::::::
	cpe:2.3:o:apple:watchos::::::::

No data.

Vendor Product Versions

Apple

Ios And Ipados

Version	Status	Scheme	Platform
`[0,27)`	affected	generic	—

Apple

Macos

Version	Status	Scheme	Platform
`[0,27)`	affected	generic	—

Apple

Tvos

Version	Status	Scheme	Platform
`[0,27)`	affected	generic	—

Apple

Watchos

Version	Status	Scheme	Platform
`[0,27)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Install the latest OS updates—iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, and watchOS 27—to eliminate the cryptographic integrity flaw
Ensure that Apple devices in privileged network environments use additional encryption layers (e.g., VPN) or restrict direct network access until the firmware update is applied
Configure network monitoring to detect anomalous packet modifications or integrity check failures in traffic to and from Apple devices

Generated by OpenCVE AI on September 20, 2026 at 19:49 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.165% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://support.apple.com/en-us/149034
https://support.apple.com/en-us/149035
https://support.apple.com/en-us/149036
https://support.apple.com/en-us/149037

History

Sep 20, 2026 8:15 PM Title updated View changes

Type	Values Removed	Values Added
Title		Cryptographic Integrity Flaw Enabling Network Traffic Modification on Apple Platforms

Sep 19, 2026 2:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 17, 2026 9:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-353

Sep 16, 2026 3:00 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple ipados Apple iphone Os
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:macos:::::::: cpe:2.3:o:apple:tvos:::::::: cpe:2.3:o:apple:watchos::::::::
Vendors & Products		Apple ipados Apple iphone Os
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N'}`

Sep 16, 2026 11:00 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Cryptographic Integrity Failure Allowing Network Traffic Modification in Apple Operating Systems
Weaknesses	CWE-327

Sep 15, 2026 9:15 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Cryptographic Integrity Failure Allowing Network Traffic Modification in Apple Operating Systems
Weaknesses		CWE-327

Sep 15, 2026 2:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios And Ipados Apple macos Apple tvos Apple watchos
Vendors & Products		Apple Apple ios And Ipados Apple macos Apple tvos Apple watchos

Sep 14, 2026 9:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		A cryptographic issue was addressed with improved integrity checks. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27. An attacker in a privileged network position may be able to modify network traffic.
References		https://support.apple.com/en-us/149034 https://support.apple.com/en-us/149035 https://support.apple.com/en-us/149036 https://support.apple.com/en-us/149037